location /example1 {
    ...
    try_files /dev/null @login;
}

location /example2 {
    ...
    error_page 404 = @login;
    return 404;
}

location @login {
    internal;
    ...
}

# will go in parent (http) block
limit_req_zone $binary_remote_addr zone=userlimit:10m rate=1r/s;

server {
    ...
}

# pass proper hostname
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $http_host;
# pass proper client IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
# pass proper protocol
proxy_set_header X-Forwarded-Proto $scheme;

# don't automatically fix "location" and "redirect" headers
proxy_redirect off;
proxy_buffering off;

proxy_pass ...; 

limit_req_status 403;
limit_req zone=serverlimit burst=10 nodelay;
limit_req zone=userlimit burst=5 nodelay;

location = /robots.txt {
    add_header Content-Type text/plain;
    return 200 "User-agent: *\nDisallow: /\n";
}

auth_request /auth;

# pass auth cookie to client
auth_request_set $saved_set_cookie $upstream_http_set_cookie;
add_header Set-Cookie $saved_set_cookie;

# use = to take precedence over other ~ locations
location = /auth {
    internal;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
    # the "reverse proxy" section discussed before
    include reverse-proxy.conf;

    # don't pass request headers
    # e.g. If-Modified will result in 412
    proxy_pass_request_headers off;
    # only pass the required
    proxy_set_header Authorization $http_Authorization;
    proxy_set_header Cookie $http_cookie;

    proxy_pass https://auth.example.com; 
}

error_page 404 403 @putoff;

location @putoff {
    return 444;
}

location / {
    error_page 418 @putoff;
    return 418;
}